user account blocked - a few times aper day

[Guest]

Hi,

we have the following problem

one of our user accounts is blocked a few times per day... but its only his acount...

does anybody know where the problem could be??

greets and thx

[cmccullough]

Re: user account blocked - a few times aper day

Do you mean it gets locked out? If so, a few thoughts are:

1. This account was used as a Service Startup account and the password has changed. Any automated procedures or services that have used this account can cause this when the password no longer matches. As the service tries to start it will use a logon attempt, and each time it tries to restart it will continue using up logon attempts.

2. Someone might be trying to hack into your system by guessing the password on this account.

3. If you have a low account lockout threshold, maybe he's just typing his password incorrectly and locking himself out.

[Guest]

Re: user account blocked - a few times aper day

hi,

thanks for your answers, so i think 2 and 3 falls out... (he´s a linux admin)

how can i find this service?? this is a very interesting thougt...

greets

[cmccullough]

Re: user account blocked - a few times aper day

You can use the Export Service function for this. It will export all services from your computers and will show the startup account information. Open the output file with Excel and sort on that column to see if his account is being used anywhere for this.

[Guest]

Re: user account blocked - a few times aper day

hi,

i´ve exported all services into an .xls file, but i´m not sure what i´m loking now...

here are the coloumns of the file:
DomainName
ServerType
ServerName
ServiceName
ServiceDisplayName
ServiceState
ServiceType
ServicePath
ServiceStartType
ServiceDepends
ServiceAccount

sorry, i just started working here

thx

[cmccullough]

Re: user account blocked - a few times aper day

When you open that with Excel, the the column you are looking at is the ServiceAccount column. Look through that column to see if you can find the user account you are having problems with.

[Guest]

Re: user account blocked - a few times aper day

hi,

its me again,´so i looked and the only entries are "LocalSystem" an "OurDomain/QT_Server"...

greets

[cmccullough]

Re: user account blocked - a few times aper day

If this is a listing of all your computers, and you don't see his user account, then that is not what is causing the lockout.

[Guest]

Re: user account blocked - a few times aper day

hi,

that were all...

and there is no account there...

what can be the problem... the account get´s locked nearly every 10 minutes...

greets

[Guest]

Re: user account blocked - a few times aper day

perhaps the problem is in the logon-script???

[Guest]

Re: user account blocked - a few times aper day

What you describe sounds remarkably similar to what we've had happen occasionally, and in our cases the culprit turned out to be a persistent manual drive mapping left on a workstation somewhere. The scenario has usually involved a user (sometimes a sysadmin) who had temporarily worked on someone's office workstation while it was still logged on under one set of credentials/profile, and for various utility reasons mapped a quick drive mapping to a shared tool folder elsewhere using his/her own different set of credentials--and inadvertently left "reconnect at logon" enabled. This would make the mapping persist with the credentials cached at the time it was created, even after the occasion was over and forgotten--and, in these cases, the original workstation's user paid no attention to it. At some point later, the second user would change his/her password, and that's when the problem would manifest itself--because that leftover mapping was still out there hammering the account with the old credentials.

May not be your ultimate solution, but I sure hope this helps!



[This message has been edited by Raff (edited 02-29-2004).]

[Guest]

Re: user account blocked - a few times aper day

Hi,
A good way to determine the source of this problem is to go through the event viewer logs on your DC's. This will tell you what machine is locking the user out, ie his own workstation or another workstation on the network.

A good tool to do this is from microsoft called event comb. It will parse your event viewer logs to only show you what you are looking for. It will also go through multiple DC's and summarize the output.

It has helped me out a number of times.

Thanks,
Tim